When upgrading from a previous version to Zabbix version 4.0.x, communication between Zabbix Server and Zabbix Proxies might no longer work.

We encountered an issue where an active proxy could no longer retrieve config data but the proxy 'last seen' timer was updating in the frontend (heartbeat was still working).

  2966:20181127:135703.726 cannot obtain configuration data from server at "<REDACTED>": ZBX_TCP_READ() timed out

After some troubleshooting it turns out the Firewall/IPS device of the customer has outdated protocol specification for the Zabbix protocol and was actively dropping the connection because it was not expecting compressed data.

Our workaround was to enable TLS encryption between the Zabbix Server and Zabbix Proxy and allowing SSL on the Zabbix protocol in the firewall device.

Of course, this is strictly not an issue with Zabbix but rather an issue of the firewall vendor needing to update protocol definitions to support the new version of the Zabbix protocol.

However, as compression is currently not a feature that can be turned off, I strongly urge to make a note of this in the upgrade notes as unsuspecting users might run into this issue while security vendors haven't yet updated their definitions:

https://www.zabbix.com/documentation/current/manual/installation/upgrade_notes_400